projects / people / teissler / ipfire-2.x.git / blame
| Commit | Line | Data |
|---|---|---|
| 2a81ab0d AM |
1 | #!/usr/bin/perl |
| 2 | ############################################################################### | |
| 3 | # # | |
| 4 | # IPFire.org - A linux based firewall # | |
| 5 | # Copyright (C) 2012 # | |
| 6 | # # | |
| 7 | # This program is free software: you can redistribute it and/or modify # | |
| 8 | # it under the terms of the GNU General Public License as published by # | |
| 9 | # the Free Software Foundation, either version 3 of the License, or # | |
| 10 | # (at your option) any later version. # | |
| 11 | # # | |
| 12 | # This program is distributed in the hope that it will be useful, # | |
| 13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of # | |
| 14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # | |
| 15 | # GNU General Public License for more details. # | |
| 16 | # # | |
| 17 | # You should have received a copy of the GNU General Public License # | |
| 18 | # along with this program. If not, see <http://www.gnu.org/licenses/>. # | |
| 19 | # # | |
| 20 | ############################################################################### | |
| 21 | # # | |
| 22 | # Hi folks! I hope this code is useful for all. I needed something to handle # | |
| 23 | # my VPN Connections in a comfortable way. # | |
| 24 | # This script builds firewallrules from the webinterface # | |
| 25 | ############################################################################### | |
| 26 | ||
| 2a81ab0d | 27 | use strict; |
| 472136c9 | 28 | use Time::Local; |
| 2a81ab0d AM |
29 | no warnings 'uninitialized'; |
| 30 | ||
| 31 | # enable only the following on debugging purpose | |
| 32 | #use warnings; | |
| 33 | #use CGI::Carp 'fatalsToBrowser'; | |
| 34 | ||
| 35 | my %fwdfwsettings=(); | |
| 36 | my %defaultNetworks=(); | |
| 37 | my %configfwdfw=(); | |
| 38 | my %color=(); | |
| 39 | my %icmptypes=(); | |
| 40 | my %ovpnSettings=(); | |
| 41 | my %customgrp=(); | |
| 42 | our %sourcehash=(); | |
| 43 | our %targethash=(); | |
| 44 | my @timeframe=(); | |
| 45 | my %configinputfw=(); | |
| 5d7faa45 | 46 | my %configoutgoingfw=(); |
| 31fef6cc | 47 | my %configdmzfw=(); |
| a6edca5a | 48 | my %confignatfw=(); |
| 2a81ab0d AM |
49 | my %aliases=(); |
| 50 | my @DPROT=(); | |
| 36196d0d | 51 | my @p2ps=(); |
| 2a81ab0d AM |
52 | require '/var/ipfire/general-functions.pl'; |
| 53 | require "${General::swroot}/lang.pl"; | |
| 54 | require "${General::swroot}/forward/bin/firewall-lib.pl"; | |
| 55 | ||
| 31fef6cc | 56 | my $configdmz = "${General::swroot}/forward/dmz"; |
| 2a81ab0d AM |
57 | my $configfwdfw = "${General::swroot}/forward/config"; |
| 58 | my $configinput = "${General::swroot}/forward/input"; | |
| 5d7faa45 | 59 | my $configoutgoing = "${General::swroot}/forward/outgoing"; |
| a6edca5a | 60 | my $confignat = "${General::swroot}/forward/nat"; |
| 36196d0d | 61 | my $p2pfile = "${General::swroot}/forward/p2protocols"; |
| 2a81ab0d | 62 | my $configgrp = "${General::swroot}/fwhosts/customgroups"; |
| 210ee67b | 63 | my $netsettings = "${General::swroot}/ethernet/settings"; |
| 2a81ab0d | 64 | my $errormessage=''; |
| 210ee67b AM |
65 | my $orange; |
| 66 | my $green; | |
| 6adcf156 | 67 | my $blue; |
| 2a81ab0d AM |
68 | my ($TYPE,$PROT,$SPROT,$DPROT,$SPORT,$DPORT,$TIME,$TIMEFROM,$TIMETILL,$SRC_TGT); |
| 69 | my $CHAIN="FORWARDFW"; | |
| ddcec9d3 | 70 | my $conexists='off'; |
| a6edca5a AM |
71 | my $command = 'iptables -A'; |
| 72 | my $dnat=''; | |
| 73 | my $snat=''; | |
| 2a81ab0d | 74 | &General::readhash("${General::swroot}/forward/settings", \%fwdfwsettings); |
| 210ee67b | 75 | &General::readhash("$netsettings", \%defaultNetworks); |
| 31fef6cc | 76 | &General::readhasharray($configdmz, \%configdmzfw); |
| 2a81ab0d AM |
77 | &General::readhasharray($configfwdfw, \%configfwdfw); |
| 78 | &General::readhasharray($configinput, \%configinputfw); | |
| 5d7faa45 | 79 | &General::readhasharray($configoutgoing, \%configoutgoingfw); |
| a6edca5a | 80 | &General::readhasharray($confignat, \%confignatfw); |
| 2a81ab0d AM |
81 | &General::readhasharray($configgrp, \%customgrp); |
| 82 | &General::get_aliases(\%aliases); | |
| 83 | ||
| ddcec9d3 AM |
84 | #check if we have an internetconnection |
| 85 | open (CONN,"/var/ipfire/red/iface"); | |
| 86 | my $con = <CONN>; | |
| 87 | close(CONN); | |
| 88 | if (-f "/var/ipfire/red/active"){ | |
| 89 | $conexists='on'; | |
| 90 | } | |
| a6edca5a AM |
91 | open (CONN1,"/var/ipfire/red/local-ipaddress"); |
| 92 | my $redip = <CONN1>; | |
| 93 | close(CONN1); | |
| 2a81ab0d AM |
94 | ################################ |
| 95 | # DEBUG/TEST # | |
| 96 | ################################ | |
| 54cb7ff0 | 97 | my $MODE=1; # 0 - normal operation |
| 2a81ab0d AM |
98 | # 1 - print configline and rules to console |
| 99 | # | |
| 100 | ################################ | |
| 101 | my $param=shift; | |
| 102 | ||
| 103 | if($param eq 'flush'){ | |
| 104 | if ($MODE eq '1'){ | |
| 105 | print " Flushing chains...\n"; | |
| 106 | } | |
| 107 | &flush; | |
| 108 | }else{ | |
| 109 | if ($MODE eq '1'){ | |
| 110 | print " Flushing chains...\n"; | |
| 111 | } | |
| 112 | &flush; | |
| 113 | if ($MODE eq '1'){ | |
| 114 | print " Preparing rules...\n"; | |
| 115 | } | |
| 116 | &preparerules; | |
| 117 | if($MODE eq '0'){ | |
| 118 | if ($fwdfwsettings{'POLICY'} eq 'MODE1'){ | |
| af49e367 | 119 | &p2pblock; |
| 5d7faa45 | 120 | system ("/usr/sbin/firewall-policy"); |
| 2a81ab0d | 121 | }elsif($fwdfwsettings{'POLICY'} eq 'MODE2'){ |
| 6adcf156 AM |
122 | $defaultNetworks{'GREEN_NETMASK'}=&General::iporsubtocidr($defaultNetworks{'GREEN_NETMASK'}); |
| 123 | $green="$defaultNetworks{'GREEN_ADDRESS'}/$defaultNetworks{'GREEN_NETMASK'}"; | |
| 6adcf156 AM |
124 | if ($defaultNetworks{'BLUE_DEV'}){ |
| 125 | $defaultNetworks{'BLUE_NETMASK'}=&General::iporsubtocidr($defaultNetworks{'BLUE_NETMASK'}); | |
| 126 | $blue="$defaultNetworks{'BLUE_ADDRESS'}/$defaultNetworks{'BLUE_NETMASK'}"; | |
| 127 | #set default rules for BLUE | |
| 128 | system ("iptables -A $CHAIN -s $blue -d $green -j RETURN"); | |
| 129 | } | |
| 5b7ed8bb AM |
130 | if ($defaultNetworks{'ORANGE_DEV'}){ |
| 131 | $defaultNetworks{'ORANGE_NETMASK'}=&General::iporsubtocidr($defaultNetworks{'ORANGE_NETMASK'}); | |
| 132 | $orange="$defaultNetworks{'ORANGE_ADDRESS'}/$defaultNetworks{'ORANGE_NETMASK'}"; | |
| 133 | #set default rules for DMZ | |
| 134 | system ("iptables -A $CHAIN -s $orange -d $green -j RETURN"); | |
| 135 | if ($defaultNetworks{'BLUE_DEV'}){ | |
| 136 | system ("iptables -A $CHAIN -s $orange -d $blue -j RETURN"); | |
| 137 | } | |
| 138 | } | |
| 6adcf156 | 139 | &p2pblock; |
| fd10a52c | 140 | system ("iptables -A $CHAIN -m state --state NEW -j ACCEPT"); |
| 5d7faa45 | 141 | system ("/usr/sbin/firewall-policy"); |
| 674f4e9d | 142 | system ("/etc/sysconfig/firewall.local reload"); |
| 2a81ab0d AM |
143 | } |
| 144 | } | |
| 145 | } | |
| 2a81ab0d AM |
146 | sub flush |
| 147 | { | |
| 148 | system ("iptables -F FORWARDFW"); | |
| 149 | system ("iptables -F INPUTFW"); | |
| 5d7faa45 | 150 | system ("iptables -F OUTGOINGFW"); |
| 28640b73 AM |
151 | system ("iptables -F PORTFWACCESS"); |
| 152 | system ("iptables -t nat -F NAT_DESTINATION"); | |
| 153 | system ("iptables -t nat -F NAT_SOURCE"); | |
| 2a81ab0d AM |
154 | } |
| 155 | sub preparerules | |
| 156 | { | |
| 31fef6cc AM |
157 | if (! -z "${General::swroot}/forward/dmz"){ |
| 158 | &buildrules(\%configdmzfw); | |
| 159 | } | |
| 2a81ab0d AM |
160 | if (! -z "${General::swroot}/forward/config"){ |
| 161 | &buildrules(\%configfwdfw); | |
| 162 | } | |
| 163 | if (! -z "${General::swroot}/forward/input"){ | |
| 164 | &buildrules(\%configinputfw); | |
| 165 | } | |
| 5d7faa45 AM |
166 | if (! -z "${General::swroot}/forward/outgoing"){ |
| 167 | &buildrules(\%configoutgoingfw); | |
| 168 | } | |
| a6edca5a AM |
169 | if (! -z "${General::swroot}/forward/nat"){ |
| 170 | &buildrules(\%confignatfw); | |
| 171 | } | |
| 2a81ab0d AM |
172 | } |
| 173 | sub buildrules | |
| 174 | { | |
| 175 | my $hash=shift; | |
| b5269091 | 176 | my $STAG; |
| a6edca5a AM |
177 | my $natip; |
| 178 | my $snatport; | |
| 179 | my $fireport; | |
| bc912c6e | 180 | my $nat; |
| 98cee89f | 181 | my $fwaccessdport; |
| 992394d5 | 182 | foreach my $key (sort {$a <=> $b} keys %$hash){ |
| ff4770c7 | 183 | next if (($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1') && $conexists eq 'off' ); |
| a6edca5a AM |
184 | if ($$hash{$key}[28] eq 'ON'){ |
| 185 | $command='iptables -t nat -A'; | |
| 08e1c65d | 186 | $natip=&get_nat_ip($$hash{$key}[29],$$hash{$key}[31]); |
| a6edca5a | 187 | if($$hash{$key}[31] eq 'dnat'){ |
| bc912c6e | 188 | $nat='DNAT'; |
| 98cee89f AM |
189 | if ($$hash{$key}[30] =~ /\|/){ |
| 190 | $$hash{$key}[30]=~ tr/|/,/; | |
| 191 | $fireport='-m multiport --dport '.$$hash{$key}[30]; | |
| 192 | }else{ | |
| 193 | $fireport='--dport '.$$hash{$key}[30] if ($$hash{$key}[30]>0); | |
| 194 | } | |
| a6edca5a | 195 | }else{ |
| bc912c6e | 196 | $nat='SNAT'; |
| a6edca5a AM |
197 | } |
| 198 | } | |
| b5269091 | 199 | $STAG=''; |
| 2a81ab0d AM |
200 | if($$hash{$key}[2] eq 'ON'){ |
| 201 | #get source ip's | |
| 202 | if ($$hash{$key}[3] eq 'cust_grp_src'){ | |
| 992394d5 | 203 | foreach my $grp (sort {$a <=> $b} keys %customgrp){ |
| 2a81ab0d AM |
204 | if($customgrp{$grp}[0] eq $$hash{$key}[4]){ |
| 205 | &get_address($customgrp{$grp}[3],$customgrp{$grp}[2],"src"); | |
| 206 | } | |
| 207 | } | |
| 208 | }else{ | |
| 209 | &get_address($$hash{$key}[3],$$hash{$key}[4],"src"); | |
| 210 | } | |
| 211 | #get target ip's | |
| 212 | if ($$hash{$key}[5] eq 'cust_grp_tgt'){ | |
| 992394d5 | 213 | foreach my $grp (sort {$a <=> $b} keys %customgrp){ |
| 2a81ab0d AM |
214 | if($customgrp{$grp}[0] eq $$hash{$key}[6]){ |
| 215 | &get_address($customgrp{$grp}[3],$customgrp{$grp}[2],"tgt"); | |
| 216 | } | |
| 217 | } | |
| 218 | }elsif($$hash{$key}[5] eq 'ipfire'){ | |
| 05d4f131 AM |
219 | if($$hash{$key}[6] eq 'GREEN'){ |
| 220 | $targethash{$key}[0]=$defaultNetworks{'GREEN_ADDRESS'}; | |
| 221 | } | |
| 222 | if($$hash{$key}[6] eq 'BLUE'){ | |
| 223 | $targethash{$key}[0]=$defaultNetworks{'BLUE_ADDRESS'}; | |
| 224 | } | |
| 225 | if($$hash{$key}[6] eq 'ORANGE'){ | |
| 226 | $targethash{$key}[0]=$defaultNetworks{'ORANGE_ADDRESS'}; | |
| 227 | } | |
| 8762442c AM |
228 | if($$hash{$key}[6] eq 'ALL'){ |
| 229 | $targethash{$key}[0]='0.0.0.0/0'; | |
| 230 | } | |
| 690b0bd7 | 231 | if($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1'){ |
| ff4770c7 | 232 | open(FILE, "/var/ipfire/red/local-ipaddress")or die "Couldn't open local-ipaddress"; |
| 2a81ab0d AM |
233 | $targethash{$key}[0]= <FILE>; |
| 234 | close(FILE); | |
| 235 | }else{ | |
| 236 | foreach my $alias (sort keys %aliases){ | |
| 237 | if ($$hash{$key}[6] eq $alias){ | |
| 238 | $targethash{$key}[0]=$aliases{$alias}{'IPT'}; | |
| 239 | } | |
| 240 | } | |
| 241 | } | |
| 242 | }else{ | |
| 243 | &get_address($$hash{$key}[5],$$hash{$key}[6],"tgt"); | |
| 244 | } | |
| 2a81ab0d AM |
245 | ##get source prot and port |
| 246 | $SRC_TGT='SRC'; | |
| 247 | $SPROT = &get_prot($hash,$key); | |
| 248 | $SPORT = &get_port($hash,$key); | |
| 249 | $SRC_TGT=''; | |
| 14f7cb87 | 250 | |
| 2a81ab0d AM |
251 | ##get target prot and port |
| 252 | $DPROT=&get_prot($hash,$key); | |
| 14f7cb87 | 253 | |
| 2a81ab0d AM |
254 | if ($DPROT eq ''){$DPROT=' ';} |
| 255 | @DPROT=split(",",$DPROT); | |
| 14f7cb87 | 256 | |
| 2a81ab0d AM |
257 | #get time if defined |
| 258 | if($$hash{$key}[18] eq 'ON'){ | |
| 472136c9 AM |
259 | my ($time1,$time2,$daylight); |
| 260 | my $daylight=$$hash{$key}[28]; | |
| 261 | $time1=&get_time($$hash{$key}[26],$daylight); | |
| 262 | $time2=&get_time($$hash{$key}[27],$daylight); | |
| 2a81ab0d AM |
263 | if($$hash{$key}[19] ne ''){push (@timeframe,"Mon");} |
| 264 | if($$hash{$key}[20] ne ''){push (@timeframe,"Tue");} | |
| 265 | if($$hash{$key}[21] ne ''){push (@timeframe,"Wed");} | |
| 266 | if($$hash{$key}[22] ne ''){push (@timeframe,"Thu");} | |
| 267 | if($$hash{$key}[23] ne ''){push (@timeframe,"Fri");} | |
| 268 | if($$hash{$key}[24] ne ''){push (@timeframe,"Sat");} | |
| 269 | if($$hash{$key}[25] ne ''){push (@timeframe,"Sun");} | |
| 270 | $TIME=join(",",@timeframe); | |
| 472136c9 AM |
271 | |
| 272 | $TIMEFROM="--timestart $time1 "; | |
| 273 | $TIMETILL="--timestop $time2 "; | |
| a0f267b9 | 274 | $TIME="-m time --weekdays $TIME $TIMEFROM $TIMETILL"; |
| 2a81ab0d | 275 | } |
| 2a81ab0d AM |
276 | if ($MODE eq '1'){ |
| 277 | print "NR:$key "; | |
| 278 | foreach my $i (0 .. $#{$$hash{$key}}){ | |
| 279 | print "$i: $$hash{$key}[$i] "; | |
| 280 | } | |
| 281 | print "\n"; | |
| 282 | print"##################################\n"; | |
| 283 | #print rules to console | |
| 2a81ab0d AM |
284 | foreach my $DPROT (@DPROT){ |
| 285 | $DPORT = &get_port($hash,$key,$DPROT); | |
| 286 | if ($SPROT ne ''){$PROT=$SPROT;}else{$PROT=$DPROT;} | |
| 287 | $PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' '); | |
| 288 | foreach my $a (sort keys %sourcehash){ | |
| 289 | foreach my $b (sort keys %targethash){ | |
| d7dc9718 | 290 | if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){ |
| 2a81ab0d | 291 | if($SPROT eq '' || $SPROT eq $DPROT || $DPROT eq ' '){ |
| 5d7faa45 | 292 | if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";} |
| 8cb1afc8 AM |
293 | if(substr($DPORT, 2, 4) eq 'icmp'){ |
| 294 | my @icmprule= split(",",substr($DPORT, 12,)); | |
| 295 | foreach (@icmprule){ | |
| 296 | if ($$hash{$key}[17] eq 'ON'){ | |
| a6edca5a | 297 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] --icmp-type $_ $TIME -j LOG\n"; |
| 8cb1afc8 | 298 | } |
| a6edca5a | 299 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] --icmp-type $_ $TIME -j $$hash{$key}[0]\n"; |
| 8cb1afc8 | 300 | } |
| a6edca5a | 301 | }elsif($$hash{$key}[28] ne 'ON'){ |
| 8cb1afc8 | 302 | if ($$hash{$key}[17] eq 'ON'){ |
| a6edca5a | 303 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n"; |
| 8cb1afc8 | 304 | } |
| a6edca5a | 305 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n"; |
| 28640b73 AM |
306 | }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat'){ |
| 307 | if ($$hash{$key}[17] eq 'ON'){ | |
| 308 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $fireport $TIME -j LOG --log-prefix 'DNAT' \n"; | |
| 309 | } | |
| 28640b73 | 310 | my ($ip,$sub) =split("/",$targethash{$b}[0]); |
| bc912c6e | 311 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n"; |
| 829697d0 | 312 | $DPORT =~ s/\-/:/g; |
| 98cee89f AM |
313 | if ($DPORT){ |
| 314 | $fwaccessdport="--dport ".substr($DPORT,1,); | |
| 315 | }elsif(! $DPORT && $$hash{$key}[30] ne ''){ | |
| 316 | if ($$hash{$key}[30]=~m/|/i){ | |
| 317 | $$hash{$key}[30] =~ s/\|/,/g; | |
| 318 | $fwaccessdport="-m multiport --dport $$hash{$key}[30]"; | |
| 319 | }else{ | |
| 320 | $fwaccessdport="--dport $$hash{$key}[30]"; | |
| 321 | } | |
| 322 | } | |
| bc912c6e | 323 | print "iptables -A PORTFWACCESS $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n"; |
| 08e1c65d AM |
324 | }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){ |
| 325 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip\n"; | |
| 2a81ab0d | 326 | } |
| 2a81ab0d AM |
327 | } |
| 328 | } | |
| 329 | } | |
| 330 | } | |
| 331 | print"\n"; | |
| 332 | } | |
| 2a81ab0d AM |
333 | }elsif($MODE eq '0'){ |
| 334 | foreach my $DPROT (@DPROT){ | |
| 335 | $DPORT = &get_port($hash,$key,$DPROT); | |
| 336 | if ($SPROT ne ''){$PROT=$SPROT;}else{$PROT=$DPROT;} | |
| 337 | $PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' '); | |
| 338 | foreach my $a (sort keys %sourcehash){ | |
| 339 | foreach my $b (sort keys %targethash){ | |
| d7dc9718 | 340 | if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){ |
| 2a81ab0d | 341 | if($SPROT eq '' || $SPROT eq $DPROT || $DPROT eq ' '){ |
| 5d7faa45 | 342 | if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";} |
| 8cb1afc8 AM |
343 | if(substr($DPORT, 2, 4) eq 'icmp'){ |
| 344 | my @icmprule= split(",",substr($DPORT, 12,)); | |
| 345 | foreach (@icmprule){ | |
| 346 | if ($$hash{$key}[17] eq 'ON'){ | |
| a6edca5a | 347 | system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] -- icmp-type $_ $TIME -j LOG"); |
| 8cb1afc8 | 348 | } |
| a6edca5a AM |
349 | system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] --icmp-type $_ $TIME -j $$hash{$key}[0]"); |
| 350 | } | |
| 351 | }elsif($$hash{$key}[28] ne 'ON'){ | |
| 352 | if ($$hash{$key}[17] eq 'ON'){ | |
| 353 | system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n"; | |
| 354 | } | |
| 355 | system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n"; | |
| 356 | }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat'){ | |
| 357 | if ($$hash{$key}[17] eq 'ON'){ | |
| 358 | system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j LOG --log-prefix 'DNAT' \n"; | |
| 8cb1afc8 | 359 | } |
| a6edca5a | 360 | my ($ip,$sub) =split("/",$targethash{$b}[0]); |
| bc912c6e | 361 | system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n"; |
| 829697d0 | 362 | $DPORT =~ s/\-/:/g; |
| 98cee89f AM |
363 | if ($DPORT){ |
| 364 | $fwaccessdport="--dport ".substr($DPORT,1,); | |
| 365 | }elsif(! $DPORT && $$hash{$key}[30] ne ''){ | |
| 366 | if ($$hash{$key}[30]=~m/|/i){ | |
| 367 | $$hash{$key}[30] =~ s/\|/,/g; | |
| 368 | $fwaccessdport="-m multiport --dport $$hash{$key}[30]"; | |
| 369 | }else{ | |
| 370 | $fwaccessdport="--dport $$hash{$key}[30]"; | |
| 371 | } | |
| 372 | } | |
| bc912c6e | 373 | system "iptables -A PORTFWACCESS $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n"; |
| a6edca5a | 374 | }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){ |
| 8cb1afc8 | 375 | if ($$hash{$key}[17] eq 'ON'){ |
| a6edca5a | 376 | system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG --log-prefix 'SNAT '\n"; |
| 8cb1afc8 | 377 | } |
| bc912c6e | 378 | system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip$fireport\n"; |
| 2a81ab0d | 379 | } |
| 2a81ab0d AM |
380 | } |
| 381 | } | |
| 382 | } | |
| 383 | } | |
| 2a81ab0d AM |
384 | } |
| 385 | } | |
| 386 | } | |
| 387 | %sourcehash=(); | |
| 388 | %targethash=(); | |
| 389 | undef $TIME; | |
| 390 | undef $TIMEFROM; | |
| 391 | undef $TIMETILL; | |
| a6edca5a | 392 | undef $fireport; |
| 2a81ab0d AM |
393 | } |
| 394 | } | |
| a6edca5a AM |
395 | sub get_nat_ip |
| 396 | { | |
| 397 | my $val=shift; | |
| 08e1c65d | 398 | my $type=shift; |
| a6edca5a AM |
399 | my $result; |
| 400 | if($val eq 'RED' || $val eq 'GREEN' || $val eq 'ORANGE' || $val eq 'BLUE'){ | |
| 401 | $result=$defaultNetworks{$val.'_ADDRESS'}; | |
| 402 | }elsif($val eq 'ALL'){ | |
| 403 | $result='-i '.$con; | |
| 08e1c65d | 404 | }elsif($val eq 'Default IP' && $type eq 'dnat'){ |
| a6edca5a | 405 | $result='-d '.$redip; |
| 08e1c65d AM |
406 | }elsif($val eq 'Default IP' && $type eq 'snat'){ |
| 407 | $result=$redip; | |
| a6edca5a AM |
408 | }else{ |
| 409 | foreach my $al (sort keys %aliases){ | |
| 08e1c65d | 410 | if($val eq $al && $type eq 'dnat'){ |
| a6edca5a | 411 | $result='-d '.$aliases{$al}{'IPT'}; |
| 08e1c65d AM |
412 | }elsif($val eq $al && $type eq 'snat'){ |
| 413 | $result=$aliases{$al}{'IPT'}; | |
| a6edca5a AM |
414 | } |
| 415 | } | |
| 416 | } | |
| 417 | return $result; | |
| 418 | } | |
| 472136c9 AM |
419 | sub get_time |
| 420 | { | |
| 421 | my $val=shift; | |
| 422 | my $val1=shift; | |
| 423 | my $time; | |
| 424 | my $minutes; | |
| 425 | my $ruletime; | |
| 426 | $minutes = &utcmin($val); | |
| 427 | $ruletime = $minutes + &time_get_utc($val); | |
| 428 | if ($ruletime < 0){$ruletime +=1440;} | |
| 429 | if ($ruletime > 1440){$ruletime -=1440;} | |
| 430 | $time=sprintf "%02d:%02d", $ruletime / 60, $ruletime % 60; | |
| 431 | return $time; | |
| 432 | } | |
| 433 | sub time_get_utc | |
| 434 | { | |
| 435 | # Calculates the UTCtime from a given time | |
| 436 | my $val=shift; | |
| 437 | my @localtime=localtime(time); | |
| 438 | my @gmtime=gmtime(time); | |
| 439 | my $diff = ($gmtime[2]*60+$gmtime[1]%60)-($localtime[2]*60+$localtime[1]%60); | |
| 440 | return $diff; | |
| 441 | } | |
| 442 | sub utcmin | |
| 443 | { | |
| 444 | my $ruletime=shift; | |
| 445 | my ($hrs,$min) = split(":",$ruletime); | |
| 446 | my $newtime = $hrs*60+$min; | |
| 447 | return $newtime; | |
| 448 | } | |
| 36196d0d AM |
449 | sub p2pblock |
| 450 | { | |
| 451 | my $P2PSTRING; | |
| 452 | my $DO; | |
| 453 | open( FILE, "< $p2pfile" ) or die "Unable to read $p2pfile"; | |
| 454 | @p2ps = <FILE>; | |
| 455 | close FILE; | |
| 456 | my $CMD = "-m ipp2p"; | |
| 457 | foreach my $p2pentry (sort @p2ps) { | |
| 458 | my @p2pline = split( /\;/, $p2pentry ); | |
| 8d1beadc AM |
459 | if ( $fwdfwsettings{'POLICY'} eq 'MODE1' ) { |
| 460 | $DO = "ACCEPT"; | |
| 5238a871 | 461 | if ("$p2pline[2]" eq "on") { |
| 36196d0d AM |
462 | $P2PSTRING = "$P2PSTRING --$p2pline[1]"; |
| 463 | } | |
| 8d1beadc | 464 | }else { |
| 36196d0d | 465 | $DO = "RETURN"; |
| 5238a871 | 466 | if ("$p2pline[2]" eq "off") { |
| 36196d0d AM |
467 | $P2PSTRING = "$P2PSTRING --$p2pline[1]"; |
| 468 | } | |
| 469 | } | |
| 470 | } | |
| 471 | if ($MODE eq 1){ | |
| 472 | if($P2PSTRING){ | |
| 473 | print"/sbin/iptables -A FORWARDFW $CMD $P2PSTRING -j $DO\n"; | |
| 474 | } | |
| 475 | }else{ | |
| 476 | if($P2PSTRING){ | |
| 477 | system("/sbin/iptables -A FORWARDFW $CMD $P2PSTRING -j $DO"); | |
| 478 | } | |
| 479 | } | |
| 480 | } | |
| 2a81ab0d AM |
481 | sub get_address |
| 482 | { | |
| 483 | my $base=shift; #source of checking ($configfwdfw{$key}[x] or groupkey | |
| 484 | my $base2=shift; | |
| 485 | my $type=shift; #src or tgt | |
| 486 | my $hash; | |
| 487 | if ($type eq 'src'){ | |
| 488 | $hash=\%sourcehash; | |
| 489 | }else{ | |
| 490 | $hash=\%targethash; | |
| 491 | } | |
| 492 | my $key = &General::findhasharraykey($hash); | |
| 493 | if($base eq 'src_addr' || $base eq 'tgt_addr' ){ | |
| b5269091 AM |
494 | if (&General::validmac($base2)){ |
| 495 | $$hash{$key}[0] = "-m mac --mac-source $base2"; | |
| 496 | }else{ | |
| 497 | $$hash{$key}[0] = $base2; | |
| 498 | } | |
| 2a81ab0d | 499 | }elsif($base eq 'std_net_src' || $base eq 'std_net_tgt' || $base eq 'Standard Network'){ |
| ddcec9d3 | 500 | $$hash{$key}[0]=&fwlib::get_std_net_ip($base2,$con); |
| 2a81ab0d AM |
501 | }elsif($base eq 'cust_net_src' || $base eq 'cust_net_tgt' || $base eq 'Custom Network'){ |
| 502 | $$hash{$key}[0]=&fwlib::get_net_ip($base2); | |
| 503 | }elsif($base eq 'cust_host_src' || $base eq 'cust_host_tgt' || $base eq 'Custom Host'){ | |
| 504 | $$hash{$key}[0]=&fwlib::get_host_ip($base2,$type); | |
| 505 | }elsif($base eq 'ovpn_net_src' || $base eq 'ovpn_net_tgt' || $base eq 'OpenVPN static network'){ | |
| 506 | $$hash{$key}[0]=&fwlib::get_ovpn_net_ip($base2,1); | |
| 507 | }elsif($base eq 'ovpn_host_src' ||$base eq 'ovpn_host_tgt' || $base eq 'OpenVPN static host'){ | |
| 508 | $$hash{$key}[0]=&fwlib::get_ovpn_host_ip($base2,33); | |
| 509 | }elsif($base eq 'ovpn_n2n_src' ||$base eq 'ovpn_n2n_tgt' || $base eq 'OpenVPN N-2-N'){ | |
| 6fab5bca | 510 | $$hash{$key}[0]=&fwlib::get_ovpn_n2n_ip($base2,11); |
| 2a81ab0d AM |
511 | }elsif($base eq 'ipsec_net_src' || $base eq 'ipsec_net_tgt' || $base eq 'IpSec Network'){ |
| 512 | $$hash{$key}[0]=&fwlib::get_ipsec_net_ip($base2,11); | |
| 513 | } | |
| 514 | } | |
| 515 | sub get_prot | |
| 516 | { | |
| 517 | my $hash=shift; | |
| 518 | my $key=shift; | |
| 519 | if ($$hash{$key}[7] eq 'ON' && $SRC_TGT eq 'SRC'){ | |
| 520 | if ($$hash{$key}[10] ne ''){ | |
| 521 | return"$$hash{$key}[8]"; | |
| 522 | }elsif($$hash{$key}[9] ne ''){ | |
| 523 | return"$$hash{$key}[8]"; | |
| 524 | }else{ | |
| 525 | return "$$hash{$key}[8]"; | |
| 526 | } | |
| 527 | }elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){ | |
| 528 | if ($$hash{$key}[14] eq 'TGT_PORT'){ | |
| 529 | if ($$hash{$key}[15] ne ''){ | |
| 530 | return "$$hash{$key}[12]"; | |
| 531 | }elsif($$hash{$key}[13] ne ''){ | |
| 532 | return "$$hash{$key}[12]"; | |
| 533 | }else{ | |
| 534 | return "$$hash{$key}[12]"; | |
| 535 | } | |
| 536 | }elsif($$hash{$key}[14] eq 'cust_srv'){ | |
| 537 | return &fwlib::get_srv_prot($$hash{$key}[15]); | |
| 538 | ||
| 539 | }elsif($$hash{$key}[14] eq 'cust_srvgrp'){ | |
| 540 | return &fwlib::get_srvgrp_prot($$hash{$key}[15]); | |
| 541 | } | |
| 542 | } | |
| 98cee89f AM |
543 | #DNAT |
| 544 | if ($SRC_TGT eq '' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[11] eq '' && $$hash{$key}[12] ne ''){ | |
| 545 | return "$$hash{$key}[12]"; | |
| 546 | } | |
| 2a81ab0d AM |
547 | } |
| 548 | sub get_port | |
| 549 | { | |
| 550 | my $hash=shift; | |
| 551 | my $key=shift; | |
| 552 | my $prot=shift; | |
| 553 | if ($$hash{$key}[7] eq 'ON' && $SRC_TGT eq 'SRC'){ | |
| 554 | if ($$hash{$key}[10] ne ''){ | |
| 8f0b047b | 555 | $$hash{$key}[10] =~ s/\|/,/g; |
| 93a5f4a5 AM |
556 | if(index($$hash{$key}[10],",") > 0){ |
| 557 | return "-m multiport --sport $$hash{$key}[10] "; | |
| 558 | }else{ | |
| a6edca5a AM |
559 | if($$hash{$key}[28] ne 'ON' || ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat') ||($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat') ){ |
| 560 | return "--sport $$hash{$key}[10] "; | |
| 561 | }else{ | |
| 562 | return ":$$hash{$key}[10]"; | |
| 563 | } | |
| 93a5f4a5 | 564 | } |
| 62fc8511 | 565 | }elsif($$hash{$key}[9] ne '' && $$hash{$key}[9] ne 'All ICMP-Types'){ |
| 2a81ab0d | 566 | return "--icmp-type $$hash{$key}[9] "; |
| 62fc8511 AM |
567 | }elsif($$hash{$key}[9] eq 'All ICMP-Types'){ |
| 568 | return; | |
| 2a81ab0d AM |
569 | } |
| 570 | }elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){ | |
| 2a81ab0d AM |
571 | if($$hash{$key}[14] eq 'TGT_PORT'){ |
| 572 | if ($$hash{$key}[15] ne ''){ | |
| 8f0b047b | 573 | $$hash{$key}[15] =~ s/\|/,/g; |
| 93a5f4a5 AM |
574 | if(index($$hash{$key}[15],",") > 0){ |
| 575 | return "-m multiport --dport $$hash{$key}[15] "; | |
| 576 | }else{ | |
| a6edca5a AM |
577 | if($$hash{$key}[28] ne 'ON' || ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat') ){ |
| 578 | return "--dport $$hash{$key}[15] "; | |
| 579 | }else{ | |
| 829697d0 | 580 | $$hash{$key}[15] =~ s/\:/-/g; |
| a6edca5a AM |
581 | return ":$$hash{$key}[15]"; |
| 582 | } | |
| 93a5f4a5 | 583 | } |
| 2a81ab0d AM |
584 | }elsif($$hash{$key}[13] ne '' && $$hash{$key}[13] ne 'All ICMP-Types'){ |
| 585 | return "--icmp-type $$hash{$key}[13] "; | |
| 586 | }elsif($$hash{$key}[13] ne '' && $$hash{$key}[13] eq 'All ICMP-Types'){ | |
| 587 | return; | |
| 588 | } | |
| 589 | }elsif($$hash{$key}[14] eq 'cust_srv'){ | |
| 590 | if ($prot ne 'ICMP'){ | |
| 6be32fe5 AM |
591 | if($$hash{$key}[31] eq 'dnat'){ |
| 592 | return ":".&fwlib::get_srv_port($$hash{$key}[15],1,$prot); | |
| 593 | }else{ | |
| 594 | return "--dport ".&fwlib::get_srv_port($$hash{$key}[15],1,$prot); | |
| 595 | } | |
| 2a81ab0d AM |
596 | }elsif($prot eq 'ICMP' && $$hash{$key}[15] ne 'All ICMP-Types'){ |
| 597 | return "--icmp-type ".&fwlib::get_srv_port($$hash{$key}[15],3,$prot); | |
| 598 | }elsif($prot eq 'ICMP' && $$hash{$key}[15] eq 'All ICMP-Types'){ | |
| 599 | return; | |
| 600 | } | |
| 601 | }elsif($$hash{$key}[14] eq 'cust_srvgrp'){ | |
| 602 | if ($prot ne 'ICMP'){ | |
| 603 | return &fwlib::get_srvgrp_port($$hash{$key}[15],$prot); | |
| 604 | } | |
| 605 | elsif($prot eq 'ICMP'){ | |
| 606 | return &fwlib::get_srvgrp_port($$hash{$key}[15],$prot); | |
| 607 | } | |
| 2a81ab0d AM |
608 | } |
| 609 | } | |
| 610 | } |